JPH0321472B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a fault diagnosis method for an elevator control device controlled by a computer.

[Conventional technology]

Conventionally, elevator control devices are mainly composed of relays, and are individually designed depending on the number of floors to be serviced and the control method and operation method of the elevator drive motor. Furthermore, since there are limits to the functionality of relay sequences, the practical use of computers is being considered, mainly for the group management control section. This computerization not only improves the functionality of elevator control equipment and enables quick response to various specifications, but also allows the use of small computers to make the equipment smaller and lighter.
Effects such as standardization can be expected. For this reason, microcomputers are increasingly being adopted as control devices.

On the other hand, the problem lies in its reliability.
This is especially the biggest technical problem to be solved in the unit control system that directly controls each elevator car, and this has a great deal to do with the benefits of microcomputerization and the reduction of the total cost of the product.

A control device using a microcontroller consists of the main body of the microcontroller, an interface circuit (input circuit and output circuit), and an elevator control system consisting of a power relay, elevator drive device, safety switches, etc.

Since the microcontroller main body is inexpensive and small, the reliability of the microcontroller main body can be dramatically improved by making the microcontroller part a multiple system. It is also possible to self-diagnose partial failures.

In addition, failures in the elevator control system can be detected by inputting appropriate control information (elevator position, elevator speed, voltage, current, temperature, etc. of each part) to the microcontroller and monitoring this. Serious accidents can be prevented by generating appropriate control outputs.

In the case of elevator control devices, there are hundreds of input/output signal lines per elevator, so the reliability of the interface circuit becomes an issue. Particularly problematic are the input circuit that inputs the control information necessary for the above-mentioned failure diagnosis, and the output circuit that outputs the control information to deal with this information.

In many cases, these interface circuits cannot be made into multiple systems due to cost and control panel mounting space considerations. Furthermore, even if a duplex system is adopted, a common circuit such as signal switching is always required, so that it is often not possible to obtain as high reliability as expected.

Therefore, there is generally a concept of automatically self-diagnosing the elevator control device centered on the interface circuit.

FIG. 1 is a circuit diagram showing an example of a known failure diagnosis circuit for an interface section related to this.

FIG. 1 is intended to outline the method used to inspect the input/output circuit during operation, and illustrates the diagnosis of continuity failure in the output circuit as an example. The function shown in FIG.
This is a circuit that drives OUT1 to OUT3.

In FIG. 1, diodes D04 to D06 and resistors R are used to detect failures in output circuits 14 to 16.
01 and an input circuit IN01 are added, and the outputs of three sets of output circuits are collectively input to the computer 10.

The computer 10 has output relays OUT1~
The signals returned from the input circuit IN01 after forcibly turning off the three output signals regardless of the original control signals for a time shorter than the release time of OUT3 and longer than the operation time of the added input circuit IN01. This system automatically determines whether a failure has occurred.

[Problem to be solved by the invention]

The failure diagnosis method described above has the following problems. In other words, in order to detect these failures with a microcontroller, input circuits, output circuits, and programs are added for that purpose, but these do not operate all the time, but only once every few months or years. Even if a failure occurs in these parts, normal service operation will normally occur. However, there was a problem in that there was no guarantee that failure detection and countermeasure control would be reliably executed in the event of a failure.

An object of the present invention is to provide a fault diagnosis method that can reliably check the operating mechanism in the event of an elevator abnormality without adding many new means in an elevator control device equipped with a computer in the logic control section. The purpose of this invention is to improve the reliability of elevator control devices.

Furthermore, if such fault diagnosis is performed on a computer, problems may occur due to the processing speed of the computer (especially on microcomputers), such as delays in elevator operation control and reception of call signals operated by users. Therefore, failure diagnosis must be performed during maintenance inspections of elevators or during periods of low traffic demand when elevators remain stopped for long periods of time.As a result, there is no guarantee that failures can be detected quickly, which is a problem. It was hot.

The present invention further enables the failure diagnosis device to operate at high frequency so that failure detection can be performed without delay, and prevents the operation of the failure diagnosis device from interfering with normal operation control of the elevator. The purpose is to provide a device that does not cause problems or inconvenience to elevator users.

[Means to solve the problem]

The features of the present invention include an elevator that services multiple floors, an elevator call signal generating means, a computer forming a logical control section of the elevator, an output circuit of this computer, and a response to an output signal from this output circuit. The computer program includes a device that controls the operation of the elevator during normal times, and a control element such as a relay that operates when the elevator is abnormal to ensure the safety of the elevator. a first step group for executing a registration process; a second step group for executing a process for controlling the operation of the elevator in response to the registered call during normal times; and at least the elevator is stopped. It has a third step group that executes a failure diagnosis of the elevator control system including the above-mentioned safety ensuring relay under the condition that The circuit configuration is such that the circuit configuration is performed without being affected by the operation, and the first step group is given a higher priority than the third step group, and when there is an elevator call interrupt signal during execution of the fault diagnosis, The system was set to restart failure diagnosis after giving priority to normal call registration processing.

[Effect]

According to the present invention having the above configuration, a service corresponding to an elevator call (elevator operation control) is normally executed based on the first and second step groups in accordance with the setting program of the computer.

Then, a decision is made to perform a failure diagnosis on the condition that the elevator is at least stopped, and the process moves to the third step group, in which control elements such as safety relays and other elevator control input/output circuits are checked. Perform fault diagnosis. That is, the failure diagnosis program is executed while the elevator is stopped so as not to affect the program that controls the operation of the elevator.

For example, in diagnosing the failure of a safety relay, the output signal that activates the relay is intentionally forced to change, and the computer inputs a signal that informs the status of the safety relay at that time. Diagnose whether or not. This goes beyond fault diagnosis of input/output circuits using a computer, which has traditionally been carried out, to control the emergency stop mechanism in the event of an abnormality, which normally rarely operates and therefore cannot detect a fault. Elements (safety relays and their output circuits) can also be automatically diagnosed using the elevator stoppage during normal times. In addition, failure diagnosis of the input/output circuit of the computer can be performed by giving commands for the purpose of failure diagnosis from the computer, in addition to the commands or input signals given during normal elevator control. While operating the device, the computer captures the status or output signal corresponding to the operation of these control devices, and diagnoses the captured signal by performing a logical comparison operation with the above-mentioned fault diagnosis command.

Furthermore, in the present invention, even if the safety relay is tested for operation during failure diagnosis, the call signal registration process that is the first step group and the output to the call answering light associated with this process are performed by the safety relay. The circuit structure is such that it functions without being affected by the operation of the first step group, and the first step group is given a higher priority than the third step group. Therefore, if the user presses the elevator call button (hall call or car call) while the third step group is being executed (during fault diagnosis), the fault diagnosis currently being executed will be temporarily interrupted by an interrupt signal. , the call signal registration process of the first step group is performed preferentially, and the corresponding call response lamp is displayed lit. After the first step group has been processed, the fault diagnosis is restarted. As a result of the failure diagnosis, if there is no abnormality, the elevator operation control of the second step group is executed. If there is a failure, the abnormality will be reported in some form. In this case, it is safer to stop the elevator service, but it may be possible to allow the elevator to operate for a short period of time, so it is best to take countermeasures depending on the situation.

Note that fault diagnosis takes several seconds, so if the elevator call button is pressed during fault diagnosis, if the call signal registration process is performed after the fault diagnosis is completed, the response may be delayed and the user may experience a delay. This will cause inconvenience to In contrast, in the present invention, as described above, priority is given to call signal registration processing over fault diagnosis, so that the above-mentioned problem can be solved without delay in call response.

Furthermore, even if failure diagnosis is performed at least on the condition that the elevator has stopped, for example, after the elevator has stopped, the doors will open and close.
If fault diagnosis is performed using the time of this opening/closing operation, time loss due to fault diagnosis can be eliminated.
Furthermore, if the failure diagnosis is performed while waiting for the door to be closed for several seconds or more, instead of opening and closing the door, it becomes possible to diagnose the failure during the elevator's quiet periods.

〔Example〕

Hereinafter, points other than the purpose and features described above will be explained in more detail with reference to an illustrated embodiment. In the following explanation, a case will be explained in which the logic control section is configured by a microcomputer, but the same can be applied to a case where the logic control section is configured by a minicomputer or the like.

An embodiment of the present invention will be described in detail with reference to FIGS. 2 to 7. In the following explanation, a control device for one elevator will be taken as an example.

FIG. 2 is a circuit diagram for explaining a specific example in which the present invention is applied to an elevator running relay control circuit section, and FIGS. 3 to 7 are flowcharts for explaining the operation. Relay A in Figure 2 is a safety confirmation relay and an emergency stop switch.
Output circuit driven by ESTOP, safety switch SCS, reverse phase loss detector relay contact SPT, and safety confirmation signal SIA from microcontroller
This is a relay that turns ON when all DR10 etc. are normal and safe driving is confirmed.

Contact A-a1 of this relay is the upward travel relay
Inserted into the closing circuit of UP and descending travel relay DN,
It is also taken into the microcontroller 10 by the input circuit IN1 at the contact A-a2.

On the other hand, safety confirmation signal on the elevator control system side
After voltage division by resistors R11 and R12, SAFT is input to the microcontroller 10 via the input circuit IN0.

Relays UP and DN include contacts DN-b and UP-b for interlock, and furthermore, an upward limit switch ULS and a downward limit switch DLS are inserted, respectively.

In addition, Final Limit Switch FLSu and
Contact points for FLSd and governor switch GRS are also inserted.

The ascending traveling relay UP and descending traveling relay DN are
Travel command SIUP output from microcontroller 10
Normally, it is controlled by output circuits DR12 and DR13 by SIDN and SIDN, and it is controlled by other contacts only in the event of an abnormality.

Contacts UP-a and DN-a are contacts that are unnecessary for simply controlling the operation of the elevator, but are used for the following purposes.

(1) When travel preparations such as door closing are completed, a travel command is output, but the relay corresponding to the travel command is
Monitor whether UP or DN is input within a specified time.

(2) When the microcontroller tries again due to a momentary power outage or noise, it is necessary to check the operation of the mechanical relays UP and DN.

(3) When the elevator reaches the destination floor, the running signal stops, but the relay UP or DN is activated within the specified time.
monitor whether they have been released.

Monitoring of (1) and (3) is performed using the steps shown in Figure 5, which will be described later.
This is done constantly in the P580, and if any of these failures are detected, control processing will be carried out in response to the trouble.

In the event of trouble (1) above, the travel command must be stopped and the door opened once to prevent passengers from being trapped.

Another possibility is to try again several times. This is effective when a door lock switch or the like is inserted in the relay UP or DN circuit.

In the event of trouble (2) above, use the safety confirmation signal SIA.
OFF, release relay A, and close its contact A-a.
By configuring relay UP or DN to be released by 1, the elevator control device ensures high safety.

In case of trouble (3) above, please use relay UP or
Since the electromagnetic brake (not shown in the diagram) continues to operate because the DN is constantly being turned on, for example, the worst case scenario is that the elevator moves with the door open due to an unbalanced load, so the above measures alone are not sufficient. be.

Checking the monitoring program and diagnosing the failure of the output circuit DR10 in (3) above are performed by the method shown in step TO1 of FIG. 6 and FIG. 7, which will be described later. It is clear that this preliminary failure diagnosis of the output circuit DR10 cannot be performed unless at least the elevator is stopped.

Furthermore, since the probability that the failures of the output circuits DR10 and DR12 or DR13 overlap during one day is extremely small, the above-mentioned failure diagnosis may be performed more frequently than once a day, for example, once when parking. It is also good as something to do. FIG. 4 shows an example in which the diagnosis is performed only once after 5 seconds of waiting for the door to be closed in steps P62 to P78. Microcontroller 10 has door open button OPEN and door close button
Operation command input such as CLOSE, parking command switch SW1, relay input, safety signal SAFT
Mechanical switch input such as and car call button input
CBT1 to CBT28, etc. are input, and the task program shown in Figure 4 (steps P46, P44, and P51)
used in Further, when the microcontroller 10 is operating reliably, the pulse R-P is outputted at regular intervals in step P67 or P78 shown in FIG. The watchdog timer WDT monitors the output of the pulse R-P to check whether the basic program shown in Figure 4, which consists of the hardware of the microcontroller 10 and important programs including the aforementioned failure detection program, is normal. Recognized during normal control operation. If the microcontroller 10 is functioning normally (if the pulse R-P is output at a constant cycle), the output permission signal OUTEN is output from the watchdog timer WDT, and the microcontroller 10 outputs the output permission signal OUTEN. Various output signals are output to the output circuit via AND circuits 31-36.

FIG. 2 does not show the entire elevator control device, but only the minimum necessary components for explaining the present invention, and there are actually many other places where the present invention can be applied.

For example, in Fig. 2, a mechanical governor contact GRS, which is required by law, is used, but in addition to this, a signal detected by a speed generator, etc., of the elevator speed is input to the microcontroller 10. Overspeed can be monitored more precisely than mechanically, and stalls and reversals (running in the opposite direction to the command) can be detected.
Depending on the situation, minor matters are merely recorded, and major matters are controlled by relay A or other alternative means to keep the elevator control system safe. These are the steps in Figure 5.
The rationality diagnosis of P580 and step P46 in Figure 4
Runs in parallel with the call service as part of TASK1. It also captures the output of sensors such as current, voltage, and temperature in each part of the elevator drive system and monitors abnormalities in the drive system and monitors related to the door motor.

In this case, the method for diagnosing the monitoring function (including input circuit and sensor functions) is to output a slow speed command from the microcomputer 10 for a period of about 0.3 seconds with the electromagnetic brake applied (elevator drive motor locked). There is a method of trying to determine whether a failure has occurred based on the sensor output that is input to an automatic control system (not shown) and taken into the microcontroller 10.

A diagnostic program including this is executed at step T15 in FIG. 6, which will be described later.

In Fig. 2, diodes D1 to D3 connected in parallel with relays A, UP, and DN are freewheel diodes that absorb the induced voltage when the relays are released, and P1 and P2 are positive power lines with different voltages. N1 is a negative power supply line common to these.

The basic fault diagnosis method of the present invention has been explained above with reference to the circuit diagram in FIG. 2.
A supplementary explanation will be provided using the flowchart shown in the figure.

Figure 3 is a flowchart showing the main program, which restarts (RES) when the power is turned on or restarts, and uses PIA (Prior Area Interface IC) and PTM (Puerial Area Timer).
IC) and RAM (random access IC) table initial settings are performed (step P20).

Next lowest priority task program
Run TASKm continuously.

TASKm includes statistical processing of elevator usage and recording of minor troubles (recording on cassettes, outputting to printers, creating trouble tables in RAM, sending to display devices and remote monitoring systems, etc.) Perform processing. Depending on the case, it performs operations such as selecting driving direction, resetting calls, and allocating hall calls for parallel elevators.

This TASKm is the interrupt (IRQ) shown in Figure 4.
is interrupted by a program started by .

However, since the processing time of the IRQ routine shown in FIG. 4 is generally short, it is not interrupted for a long period of time, so real-time performance is not impaired.

However, the fault diagnosis program added according to the present invention (step P68, TEST1 program in Figure 6)
Since this is a long program that requires tens of millimeters to several seconds, real-time performance is lost during this fault diagnosis, so it is necessary to limit the program to the functions described above. For example, call registration control and response light lighting control cannot be included in TASKm because it is undesirable for them to be interrupted (lose real-time performance) even during diagnosis according to the present invention.

The IRQ routine in Figure 4 is used for PIA, PTM, ACIA
(Unsyncronous interface adapter
It is activated by an interrupt signal input from a device such as an IC. The microcontroller 10 is shown in FIG. 4 as having a configuration in which a timer interrupt is generated every several tens of milliseconds using at least PTM or dedicated timer hardware.

Tasks TASK1 and TASK2 are task programs that require even higher real-time performance (responsiveness) than this timer cycle, such as communication processing with a separately provided group management microcontroller section and acceleration/deceleration processing. Place a program such as special processing.

Each of these tasks generates a dedicated interrupt signal to start an IRQ routine, determines the cause of the interrupt in step P41 or step P43, and jumps to the task program corresponding to the cause.

Two types of high-speed interrupt tasks are illustrated here.
In reality, more tasks may be required;
In such cases, the OS (operating system)
A management program called ``executs'' determines which program to start based on not only interrupt factors but also inter-task linkages.

Generally, the IRQ routine is started by a timer interrupt every several tens of milliseconds, the cause is determined in step P50, and the TASKn program (step P51) shown in FIG. 5 is started.

This task TASKn performs general elevator operation control processing.

When this is completed, the fault diagnosis program added according to the present invention is started. For example, if the call service is in progress, the system will pass through steps P60, P62, P63 and P78.
Since it exits to RTI, processing of the lowest level program TASKm is resumed without requiring much processing time, and waits for the IRQ routine to be activated again by the next timer interrupt.

In Figure 4, the diagnostic program TEST is performed only once after the call service is completed and the door is closed for 5 seconds.
1 (details of step P68 are shown in FIG. 6), in which startup is performed in steps P60 and P62, and only one startup is controlled in step P63 and step P65.

Once the diagnostic program TEST1 in step P68 is started, it will not finish in a short time and there is a strong possibility that it will not finish before the next timer interrupt occurs.

However, since tasks TASK1 to TASKn that must be given priority over the diagnostic program TEST1 are included, the interrupt mask is canceled at step P60.

FIG. 6 shows an example of a diagnostic program. Here, examples of six diagnostic patterns are shown. Each step is assigned a test step TSTP, and is given the number of the step currently being executed, as shown in the flowchart of the relay A diagnostic step shown in FIG. What was originally set to 0 at step P63 in Figure 4 is changed to step T01 in Figure 6.
When the diagnostic execution starts, a number greater than or equal to 1 and less than m is given.

After all diagnostics are completed, the test step
TSTP becomes m.

If a timer interrupt occurs while step P68 in FIG. 4 is being executed, the program of task TASKn in step P51 is executed through steps P41, P43, and P50.

A detailed example of this is shown in FIG. First, timer processing (step P520) is performed to obtain the automatic door closing time limit, etc., and then signal acquisition processing (step P520) is performed to acquire signals from the input circuits including input circuits IN0 to IN34 in
P525). Next, the registration control process (step P540) for the inputted car calls and hall calls is performed.

Next, in step P545, it is determined in test step TSTP whether or not a failure diagnosis is being performed. If it is in call service as originally, TSTP = 0
At this time, the machine control processing shown in steps P560 to P580 is performed.

However, if the fault is being diagnosed, select YES in step P545.
The result is "Y", and the process jumps to step P590, where output signal switching processing to the output circuits including the output circuits DR10 to DR13 shown in FIG. 2 is performed.

Therefore, in the example shown in Figure 5, the task
The processing time of TASKn is short, and even if a service request signal such as a hall call occurs during diagnosis, the call response light will continue to light up as usual, but at least the elevator running function will end the diagnosis. It will be temporarily suspended until. Note that fault diagnosis is performed on the premise that the microcontroller 10 has a normal function to perform fault diagnosis (pulse RT is output at a constant cycle). In this state, as described above, the watchdog timer WDT outputs the output permission signal OUTEN, and the output signal from the microcomputer 10 is ready to be outputted via one of the AND circuits 31-36. Therefore, when performing a failure diagnosis of a control element such as the safety confirmation relay A (diagnosis of whether the safety confirmation relay A is released), the safety confirmation relay is connected from the microcontroller 10 to the relay output circuit DR10. A signal is sent to have A released. Even during such fault diagnosis, if the elevator call buttons CBT1 to CBT28 are pressed, the call signal is registered and processed by the microcomputer 10, and the output of the call response is sent to the AND circuits 34 to 36. (Although the numbers 34 to 36 are omitted in the figure, they are actually as many AND circuits as there are call buttons). In this embodiment, the program is set to give priority to the above-mentioned call signal if it occurs even during failure diagnosis.

Here, we return to the explanation of FIG. 4 again. As mentioned above, when task TASKn is finished, the step
The process proceeds to P60, P62, and P65, and since TSTP is a value greater than 1, it is determined in step P70 whether or not the failure diagnosis has already been completed. (At the end of the process, TSTP is set to m by step T90 in FIG. 6.) This step allows fault diagnosis to be performed only once.

Next, step P72 is a software watchdog timer for detecting cases where the troubleshooting program runs out of control due to bugs in the troubleshooting program itself, noise, or bit loss in the ROM, and is not processed correctly. If it is determined that
Error handling is performed at P76.

If failure diagnosis is to be continued, a pulse is issued to reset the watchdog timer WDT at step P78, RTI is performed, and the timer interrupt is generated to return to the interrupted diagnostic program.

Therefore, during fault diagnosis, task TASKm in Figure 3
There is no going back to the program.

In addition, the program shown in Figure 4 sets the reset pulse of the WDT at the 4th pulse so that abnormalities are monitored by the hardware watchdog timer shown in Figure 2.
It is inserted at the final step in the diagram.

Step P67 is necessary because step 78 is not reached in the first cycle of fault diagnosis.

As mentioned above, the failure diagnosis program TEST1
The system uses a software WDT and a hardware WDT to constantly monitor whether at least a portion of the system is executed at predetermined intervals, making it extremely reliable in this respect as well.

Next, the example of the fault diagnosis program shown in FIG. 6 will be explained in detail.

First, it is stored in ROM etc.
The TASK program is diagnosed by a method such as thumb check.

Next, rewrite the RAM and perform a read test.

Next, perform functional tests such as PIA and PTM. At least rewrite the control register and perform a read test.

Next, the elevator drive system mentioned above is tested.

A specific example of step T20 will be explained with reference to FIG. 7 for relay A in FIG. 2.

First, table the test step number 20.
Place the number in TSTSP. Next, the input circuit signal is determined in step T210, and if it is normal, the safety confirmation output signal SIA is forcibly switched from "1" to "0" for testing. Step T220 waits for a time limit that exceeds the operating time limit of relay A, and step T225 tests whether the input signal IN1 has become "0". If relay A and output circuit DR10 are normal, they should be “0” and the next step T230
, and forcibly switch the ascending and descending command signals SIUP and SIDN to "1" and output them for testing.

Next, in step T235, relay UP and relay
After waiting for a period corresponding to the operating time limit of DN, it is checked in step T240 that input circuit signals IN2 and IN3 are both "0". This is a step for diagnosing welding of contact A-a1 of relay A.

If a failure is determined in these tests, the error processing in test step 20 is executed.
It is executed by T245 and notifies maintenance staff, managers, and elevator users of the cause of the failure clearly.

For example, it is necessary to notify diagnostic information such as stopping the time display on the clock installed in the car or on the monitoring panel and displaying trouble number 20, and requesting prompt repair.In this case, it is better to stop the elevator service. Although it is safe, there are cases where it is acceptable to operate the device for a short period of time, and these processes are also performed.

Next, the output signals forcibly output in steps T215 and T230 are returned to their original state, and the process proceeds to RTS, whereupon test step T20 in FIG. 6 is completed.

In the next step T30, general input circuits and output circuits are checked, and failure diagnosis can be performed with relatively high accuracy using the conventional technique shown in FIG.
However, for failure diagnosis of input/output circuits and elevator control systems that require particularly high accuracy, it is necessary to create and add a special circuit like relay A in Figure 2 and an individual diagnostic program as shown in Figure 7. However, this method can be easily implemented in the same way as the above method.

When all of these test steps are completed, step T90 is executed to reach RTS, and step P68 in FIG. 4 is completed.

According to the output explained above, when the elevator is in a condition where a failure can be diagnosed by the failure diagnosis program constantly monitored by the watchdog timer WDT, the actual operation of the hardware of the elevator control system and the operation delay time are included. This makes it possible to diagnose a wide range of conditions with extremely high reliability.

〔Effect of the invention〕

As explained above, according to the present invention, it is possible to reliably diagnose the operating mechanism in the event of an abnormality that does not normally operate, by taking advantage of the high processing power of the computer forming the logic control unit and adding a weak means. Therefore, the reliability of the elevator control device can be improved.

In addition, the operation of the failure diagnosis device of the present invention does not impair the elevator's normal operation control, operation, and usability, and enables diagnosis at any time, at least on the condition that the elevator is stopped. Therefore, failure diagnosis can be performed reliably without delay.

Furthermore, according to the present invention, if a call signal is generated even during failure diagnosis of the elevator control system, the failure diagnosis is temporarily interrupted and priority is given to the registration process of the call signal and the associated output to the response light. Therefore, failure diagnosis can be performed without causing any inconvenience to customers.

[Brief explanation of the drawing]

Fig. 1 is a circuit diagram for explaining a conventional failure diagnosis method, Fig. 2 is a circuit diagram of an embodiment of an elevator control device to which the present invention is applied, and Figs. 3 to 7 are a failure diagnosis method according to the present invention. Figure 3 is a flowchart of the main program, Figure 4 is a flowchart of the interrupt program, Figure 5 is a flowchart of the machine control processing program, and Figure 6 is the fault diagnosis processing. Program Flowchart FIG. 7 is a flowchart of the safety confirmation relay diagnostic processing program. 10...Microcomputer, DR10~
DR13...Output circuit, IN0-IN34...Input circuit, WDT...Watchdog timer, A...
...Safety confirmation relay, UP...Rising travel relay,
DN...Descent travel relay.

Claims (1)

[Claims] 1. An elevator that serves multiple floors;
An elevator call signal generating means, a computer forming a logic control section of the elevator, an output circuit of this computer, a device for controlling the operation of the elevator in normal times according to an output signal from this output circuit, and an abnormality of the elevator. The computer program includes a first step group for registering a call signal from the call signal generating means, and a control element such as a relay that operates at normal times to ensure the safety of the elevator. A second step group that executes processing for controlling elevator operation in response to a registered call, and a failure diagnosis of the elevator control system including the safety relay, provided that the elevator is at least stopped. The circuit has a third step group to be executed, and the above-mentioned call signal registration processing and the output to the call answering lamp accompanying this processing are performed without being affected by the operation of the above-mentioned safety ensuring relay, and the above-mentioned The first step group is given a higher priority than the third step group, and if there is an elevator call interrupt signal while a fault diagnosis is being executed, the normal call registration process is given priority and then the fault diagnosis is performed. A failure diagnosis method for an elevator control device, characterized in that the elevator control device is set to be restarted.